Source: CISA
CISA has issued an urgent alert for CVE-2026-102764, a critical authentication bypass vulnerability in BeyondTrust Remote Support (formerly Bomgar) affecting version 26.2.3 and earlier. The agency added the flaw to its Known Exploited Vulnerabilities catalog on 16 October 2026, and the evidence behind that decision is serious: the vulnerability has been exploited in the wild since 29 August 2026 by a China-linked espionage group tracked as Armory Castle. Attackers used it to gain unauthenticated root access to appliances, access stored credentials, and establish persistence with a PHP web shell named SAWFLY.
What affected organisations must do now
For organisations running self-hosted Remote Support appliances, CISA’s guidance is direct. Apply the BT26-05-RS patch from BeyondTrust advisory BT26-05, and note that versions older than 24.3.1 must be upgraded first before the patch can be installed. BeyondTrust-hosted SaaS deployments have already been patched by the vendor. CISA also recommends limiting external access to administrative interfaces, and treating exposed appliances as potentially compromised by running network and memory forensics, hunting for unrecognised privileged sessions, unexpected script files and gaps in log forwarding. If compromise is suspected, isolate the appliance, rebuild from a known-good state, rotate every credential the appliance stored or injected, revoke active support sessions and review MFA registrations on privileged accounts.
Why European IT teams should care
Remote support appliances are exactly the kind of perimeter-facing, credential-rich system that both criminal and state-linked actors target, and they frequently sit outside normal patch cycles because they are seen as infrastructure rather than applications. For European organisations subject to NIS2, an intrusion that moves laterally from a remote access tool into the wider network is a reportable incident with strict timelines. If your team runs BeyondTrust or any internet-facing remote access appliance and you are not sure whether it is patched, monitored or exposing administrative interfaces to the open internet, that uncertainty is itself the risk.
If you need help auditing your remote access estate, verifying patch levels, hunting for signs of compromise, or setting up the logging and alerting that would catch this class of attack, contact Excello Digital at https://excello.digital/contact/. We help European companies turn emergency advisories into a controlled, documented response.